Forum Discussion
NacreousFalse positive ASM block
ASM security policy blocking the request as it is detecting an attack in the content.ASM is blocking because of cross site scripting attack. Subscriber names are coming in HTTP request. eg.Shelly. ASM is detecting as it as "shell" and blocking the request. Details of attack are violation as url shell parameter and attack cross site scripting. Is there any way to exclude these parameters(url, shell) We don't want to disable whole XSS signature attack.
1 Reply
Cory_50405Noctilucent
Yep. Navigate to Application Security -> Parameters -> Parameters List and then select the policy you wish to edit. Create a new parameter, name it appropriately, and set it to a user-input value. Then at the bottom, click the attack signatures tab and select the signature that is incorrectly firing on the parameter and move it over to the overriden security policy settings pane. Ensure the dropdown for this signature says disabled.
This will disable the attack signature only for the specific parameter.
